diff --git a/TryHackMe/Hygine.md b/TryHackMe/Hygine.md
new file mode 100644
index 0000000..29c77cf
--- /dev/null
+++ b/TryHackMe/Hygine.md
@@ -0,0 +1,118 @@
+# TryHackMe-Hygiene
+
+## NMAP
+
+```bash
+
+PORT STATE SERVICE REASON VERSION
+22/tcp open ssh syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
+| ssh-hostkey:
+37652/tcp open ftp syn-ack ttl 63 ProFTPD 1.3.5e
+| ftp-anon: Anonymous FTP login allowed (FTP code 230)
+|_-rw-r--r-- 1 1000 1000 118 Oct 29 02:21 memo.txt
+Service Info: OSs: Linux, Unix; CPE: cpe:/o:lisnux:linux_kernel
+8080/tcp open http-proxy
+| fingerprint-strings:
+| LDAPBindReq:
+| HTTP/1.1 400
+| Content-Type: text/html;charset=utf-8
+| Content-Language: en
+| Content-Length: 2295
+| Date: Thu, 04 Nov 2021 13:02:11 GMT
+| Connection: close
+| HTTP Status 400
+| Request
+
+from the `memo.txt` file we see that a user named `joe` has sent email with the password hash and on cracking the hash we get the password `nightmare`
+
+
+
+## PORT 8080 (HTTP)
+
+On the webserver there's apache tomcat running
+
+
+
+if we run `stegcracker` on the png image we can find a easter egg
+
+
+
+
+
+
+
+## Foothold
+
+### Un-inteded
+
+We were told to find a username on the page but there wasn't any . All we know is that the username is of 5 characters so let's maybe try to brute force the username with 5 characters
+
+
+
+
+
+We can now then get a shell as `sally`
+
+
+
+
+### Intended
+
+Running `gobuster` we can find some directories
+
+
+
+I tried using default creds on `/manager` , `/host-manager` but wasn't succesful so I did a recusive fuzz on `admin`
+
+
+
+This returned us `staging` so again running gobuster on this
+
+
+
+
+
+We don't see much here but if we look at the source we can find the username `sally`
+
+
+
+We can now then get a shell through ssh
+
+
+
+On doing `sudo -l` we can't do run any thing as root as other user since this user isn't in sudoers file
+
+
+
+## Privilege Escalation (Joe)
+
+We can the find the user flag in `Desktop` folder of sally and can find another flag in `/home/sally/.local/share/Trash/files`
+
+
+
+The hash can be cracked with either `hashcat` or `john` but I'll just use cracksation as I did earlier
+
+
+
+## Privilege Escalation (root)
+
+Running `sudo -l` we can see that this user can run all commands
+
+
+
+## References
+
+- https://askubuntu.com/questions/911204/how-to-extract-only-7-characters-using-grep